BIND DNS query log — Forensic Artifact Reference (Network)

01Location

The channel assigned to the 'queries' logging category in named.conf (a file, syslog or stderr)
Query logging is off unless the queries category or the querylog option enables it

Which client address asked this resolver for which name and record type?
How many times was a name queried inside a window, and from how many different clients?
Does the number of queries match the number of connections seen elsewhere, and if not, can caching explain the gap?

Format	Text. Example from the manual: client @0x7f91b8005490 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +E(0)K (127.0.0.1). Flags follow the type: + or - for Recursion Desired, S signed, E(#) EDNS version, T TCP, D DO, C CD, V valid server cookie, K cookie without a valid server cookie.
Applies to	Behaviour as described in the current BIND 9 Administrator Reference Manual. Other resolvers (Unbound, Windows DNS, dnsmasq) have their own logs and formats.

Field	What it tells you
client @0x…	A client object identifier in hexadecimal. The client address, port and name are repeated in later messages about the same query.
Client address#port	The address and source port the query came from. If clients use a forwarding resolver or a proxy that resolves names for them, or sit behind NAT, this is the address of that device.
Name, class, type	The name asked for, its class (IN) and record type such as A or AAAA.
Flags (+, -, S, E, T, D, C, V, K)	Recursion Desired, signed query, EDNS version, TCP transport, DNSSEC OK, Checking Disabled and cookie state.
(destination address)	The address the query was sent to, that is, the address of the server that received it.
[ECS address/source/scope]	Present only if the client query carried a CLIENT-SUBNET option.

Field	Encoding	Note
Line prefix	Depends on the channel's print-time setting	print-time can be no (the default), yes or local, iso8601, iso8601-utc or iso8601-tzinfo. With no, a file channel writes no date and time at all. yes/local and iso8601 write local time without an offset; iso8601-utc writes UTC; iso8601-tzinfo writes local time with its offset. Syslog adds its own time stamp.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

Collect named.conf and every included file to learn which channel receives the queries category and with which print-time value.
State the time zone and format of the prefix. If it carries no offset, establish the host's zone from another record before converting.
Filter on name and client, and keep A and AAAA queries separate. One lookup can produce both.
The query log holds no TTL; take it from a response log, a capture or a dated lookup. A client holding a valid cached answer usually sends no new query to this resolver until it expires.
Map the client address to a host with the DHCP lease valid at that moment before attributing a query to a workstation, and check whether a proxy or forwarder asked on the client's behalf.

The log shows queries that reached this resolver. Answers served from a client's or another resolver's cache, and queries sent to a different resolver, do not appear.
A query shows that a name was looked up. It does not show that a connection followed or what was transferred.
The query log is optional and, as the manual says, costs performance on busy servers; an empty log may mean it was never enabled.
The TTL belongs to the answer record. RFC 1035 defines it as the time a record may be cached; resolvers and clients may apply their own limits.